diff --git a/services/pihole.nix b/services/pihole.nix
index b7ac31b..dbcefa9 100644
--- a/services/pihole.nix
+++ b/services/pihole.nix
@@ -14,7 +14,7 @@
   virtualisation.oci-containers = {
     backend = "podman";
     containers.pihole = {
-      image = "pihole/pihole:latest";   # TODO: pin to the tested version after VM check
+      image = "pihole/pihole:2026.07.2";   # validated in mercury-vm
       autoStart = true;
       extraOptions = [
         "--network=host"                    # DHCP broadcast + host unbound on 127.0.0.1